Yes you could, although the bar is still a lot higher than if it's open source. You will have to fully re-test all possible paths in the app every time a new release is made if it's closed source. If it's open, you just need to look at the git log.

Plus if there is one legitimate network call, then this strategy is out since you can't know what that request contains. OP using in-app purchases, so I'm willing to be there's at least one network call in there.

If there is no network access permission at all, then I think we agree, that's a reasonable guarantee.

Interesting if in-app purchase is registered as the app network access vs Google Play services network access.